基于GoP特征的隐藏摄像头识别方法  

Hidden camera recognition method based on GoP features

作　　者：马永强 魏果 刘文艳 刘粉林 MA Yongqiang;WEI Guo;LIU Wenyan;LIU Fenlin(Key Laboratory of Cyberspace Situation Awareness of Henan Province,Zhengzhou 450001,China;State Key Laboratory of Mathematical Engineering and Advanced Computing,Zhengzhou 450001,China)

机构地区：[1]网络空间态势感知河南省重点实验室,郑州450001 [2]数学工程与先进计算国家重点实验室,郑州450001

出　　处：《网络空间安全科学学报》2024年第5期109-120,共12页Journal of Cybersecurity

基　　金：河南省重点研发专项(221111321200)。

摘　　要：结构特性是推断设备类别和型号的重要依据之一,然而由于Wi-Fi网络通过WPA/WPA2、WPA-PSK/WPA2-PSK、WEP等多种方式加密,现有基于无线流量特征的隐藏摄像头识别方法难以从加密后的数据中提取结构特性。为此,提出了一种基于GoP(GroupofPictures)特征的隐藏摄像头识别方法CEASE。所提方法首先采用对比时间间隔策略恢复丢失数据包,然后基于摄像头视频编码和传输原理构建GoP,并在GoP上使用聚合函数提取特征向量,最后基于已有LightGBM方法进行训练并对设备类别和型号进行推断。在大量实测流量上开展了相关实验并与近年来的典型识别方法进行了对比,结果表明:与使用手工构造特征的DeWiCam和ScamF方法相比,CEASE方法设备类别识别准确率分别提升了4.2%和3.4%、摄像头型号识别准确率分别提升了32.9%和38.4%;与同样在多窗口上提取聚合特征的Lumos方法相比,CEASE方法设备类别识别准确率提升了1.6%、摄像头型号识别准确率提升了8.3%。Structural characteristics are one of the important bases for inferring device categories and models.However,because Wi-Fi networks are encrypted in various ways such as WPA/WPA2,WPA-PSK/WPA2-PSK,WEP,etc.,existing hidden camera identifi-cation methods based on wireless traffic characteristics are difficult to extract structural characteristics from encrypted data.To solve this problem,a hidden camera identification method CEASE based on the GoP(Group of Pictures)features was proposed.The proposed method first employed a nearest neighbor time interval contrast strategy to recover lost packets.Then,it constructed GoPs based on the principles of camera video encoding and transmission,extracting feature vectors using aggregation functions on these GoPs.Finally,the LightGBM method was applied for training and to infer device categories and models.Extensive experiments were conducted on sub-stantial real-world traffic data,with comparisons made against representative methods in recent years.The results demonstrated that compared to DeWiCam and ScamF,which used manually crafted features,the proposed method improved device category recognition accuracy by 4.2%and 3.4%respectively,and camera model recognition accuracy by 32.9%and 38.4%respectively.When compared to Lumos,another method that extracted aggregated features across multiple windows,the device category recognition accuracy was im-proved by 1.6%,and the camera model recognition accuracy was enhanced by 8.3%.

关 键 词：摄像头识别 GoP特征 视频编码 聚合函数 LightGBM 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]